State of indiana department of financial institutions
Download 0.86 Mb.
|
- Navigate this page:
- STATE OF INDIANA
 STATE OF INDIANADEPARTMENT OF FINANCIAL INSTITUTIONS30 South Meridian Street, Suite 300Indianapolis, Indiana 46204-2759 Telephone: (317) 232-3955Facsimile: (317) 232-7655 Web Site: http://www.in.gov/dfi 
SUPERVISORY MEMORANDUM June 6, 2013 TO: All State-Chartered Banks; FROM: Director David Mills SUBJECT: Standards for the Risk Management of Corporate Account Takeovers
Purpose This Supervisory Memorandum establishes minimum standards for a risk management program to specifically minimize the risks of Corporate Account Takeovers. Hundreds of electronic thefts through Corporate Account Takeover have impacted financial institutions and corporate account holders. Municipalities, school districts, churches, large non-profit organizations, corporate businesses, and any customers that perform electronic transfers are potential targets of cyber thieves. This type of theft can cause significant financial harm on its victims and impact entire communities and financial institutions. This Supervisory Memorandum reinforces the Indiana Department of Financial Institutions position that all financial institutions should identify, develop, and implement appropriate risk management measures for electronic crimes. Background Corporate Account Takeover is a form of business identity theft where cyber thieves gain control of a business’ bank account by stealing employee passwords and other valid credentials. Thieves can then initiate fraudulent wire and ACH transactions to accounts controlled by the thieves. Businesses with limited or no internal computer safeguards and disbursement controls for use with the financial institution’s online banking system are vulnerable to theft when cyber thieves gain access to their computer systems, typically through malicious software (malware). Malware infects a business’ computer system not just through ‘infected’ documents attached to an email but also simply when an infected Web site is visited. Businesses across the United States have suffered large financial losses over the last few years from these thefts through the banking system. Electronic thefts through financial institutions have ranged from a few thousand to several million dollars1. These thefts have occurred in financial institutions of all sizes and locations and may not be covered by the financial institution’s insurance. Along with the financial impact, there is also a very high level of reputation risk for financial institutions. As a result of these growing thefts, the Indiana Department of Financial Institutions has been working with the Conference of State Bank Supervisors, the United States Secret Service, and the Financial Services Information Sharing and Analysis Center (FS-ISAC) to provide a risk mitigation program to assist banks in protecting corporate account holders. The risk mitigation program was developed by an Electronic Crimes Task Force (Task Force) of bankers in Texas working with the US Secret Service, bank trade associations, and a payment processing association. The Task Force was composed of operational executives from a diverse group of banks in terms of size, complexity, and market environment. This is an industry developed program designed specifically to assist other financial institutions. Overview The Task Force developed a list of recommended processes and controls which expanded on a three-part risk management framework of: 1) Protect; 2) Detect; and 3) Respond developed by the United States Secret Service, the Federal Bureau of Investigation, the Internet Crime Complaint Center (IC3), and the FS-ISAC2. The Task Force also developed Best Practices for Reducing the Risks of Corporate Account Takeovers (Best Practices) to help financial institutions establish specific practices to implement the recommended processes and controls. The Best Practices document is a valuable resource to effectively reduce risk. As the Task Force was concluding its work related to Corporate Account Takeover, the Federal Financial Institutions Examination Council (FFIEC) released Supplement to Authentication in an Internet Banking Environment (FFIEC Supplemental Guidance). The FFIEC Supplemental Guidance, issued on June 28, 2011, reinforces previous FFIEC guidance related to risk management of online transactions and updates regulatory expectations regarding customer authentication, layered security, and other controls related to online activity. The Task Forces’ recommended three-part Corporate Account Takeover risk management framework and related controls are similar to controls in the FFIEC Supplemental Guidance and include the minimum expectations conveyed in the FFIEC guidance. However, the Task Force guidance has a more specific focus on reducing the risk of Corporate Account Takeovers and therefore provides additional steps to help protect financial institutions and corporate customers. Minimum Standards for a Risk Management Program to Mitigate Risks of Corporate Account Takeover There are nineteen processes and controls (components) to support the three-part risk management framework of Protect, Detect, and Respond. Management and the board of directors of all financial institution must address each of these nineteen components (attachment A) in a risk management program to mitigate the risk of Corporate Account Takeover. Since the industry Task Force that developed the program included both small and large bank representatives, the required components are broad enough to accommodate the unique needs of every financial institution and its customers utilizing online banking services. Financial institutions may adopt any practices to implement the components of Protect, Detect, and Respond. Although the use of the Task Force developed Best Practices is optional, it will greatly assist most financial institutions in implementing or expanding practices. The Best Practices are cross referenced to each of the components listed below and are attached. If your financial institution does not have any business customers that send electronic instructions to transfer funds, you would only need to complete the risk assessment mentioned in P1 below of this Supervisory Memorandum. The Indiana Department of Financial Institutions has adopted the attached components supporting the Protect, Detect, and Respond framework in setting the minimum standards for a risk management program to mitigate the risks of Corporate Account Takeover. The Indiana Department of Financial Institutions will review implementation efforts for reducing the risks of these electronic crimes through [both on-site and off-site] reviews. These reviews will focus on the nineteen components in this Memorandum as well as the FFIEC Supplemental Guidance. Examination staff reviews will begin July of 2013. For further information about this memorandum, contact Randall L. Rowe, Bank Supervisor, at (317) 232-5852. Attachment A: Corporate Account Takeover - Minimum Standards for a Risk Management Program Attachment B: Best Practices - Reducing the Risks of Corporate Account Takeovers Attachment A Corporate Account Takeover - Minimum Standards for a Risk Management Program Protect Implement processes and controls to protect the financial institution and corporate customers. P1. Expand the risk assessment to include corporate account takeover. P2. Rate each customer (or type of customer) that performs online transactions. P3. Outline to the Board of Directors the Corporate Account Takeover issues. P4. Communicate basic online security practices for corporate online banking customers. P5. Implement/Enhance customer security awareness education for retail and high risk business account holders. P6. Establish bank controls to mitigate risks of corporate accounts being taken over. P7. Review customer agreements. P8. Contact your vendors to regularly receive information regarding reducing the risk of Corporate Account Takeovers. Detect Establish monitoring systems to detect electronic theft and educate employees and customers on how to detect a theft in progress. D1. Establish automated or manual monitoring systems. D2. Educate bank employees of warning signs that a theft may be in progress. D3. Educate account holders of warning signs of potentially compromised computer systems. Respond Prepare to respond to an incident as quickly as possible (measured in minutes, not hours) to increase the chance of recovering the money for your customer. R1. Update incident response plans to include Corporate Account Takeover. R2. Immediately verify if a suspicious transaction is fraudulent. R3. Immediately attempt to reverse all suspected fraudulent transactions. R4. Send a “Fraudulent File Alert” through FedLine. R5. Immediately notify the receiving bank(s) of the fraudulent transactions and ask them to hold or return the funds. R6. Implement a contingency plan to recover or suspend any systems suspected of being compromised. R7. Contact law enforcement and regulatory agencies once the initial recovery efforts have concluded. R8. Implement procedures for customer relations and documentation of recovery efforts. Best Practices for Banks Reducing the Risks of Corporate Account Takeovers (Developed by the Texas Bankers Electronic Crimes Task Force)  
Directory: dfi dfi -> Actsm see Automated Confirmation Transaction Service dfi -> The Arithmetic Operators dfi -> How to finance a used car dfi -> Auto leasing dfi -> Indiana Department of Financial Institutions Where To Go for Auto Service Download 0.86 Mb. Share with your friends:
|